CVE-2018-17400

The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by intercepting the user name and PIN during the initial configuration of the application. NOTE: the vendor says that, to exploit this, the user has to...

CVE-2018-17403

The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to impersonate a user and set up their account without their knowledge. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide accessibili...

CVE-2018-17402

The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to discover the Credit/Debit card number, expiration date, and CVV number. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide...

CVE-2018-17400

The PhonePe wallet (com.PhonePe.app) for Android versions 3.0.6–3.3.26 is documented to support potential Account Takeover via interception of the user name and PIN during initial configuration. Exploitation requires the user to install a malicious app and grant it accessibility permission; the A...

CVE-2018-17401

The PhonePe wallet aka com.PhonePe.app application 3.0.6 through 3.3.26 for Android might allow attackers to perform Account Takeover attacks by exploiting its Forgot Password feature. NOTE: the vendor says that, to exploit this, the user has to explicitly install a malicious app and provide...

CVE-2018-17402

CVE-2018-17402 (PhonePe wallet) affects Android versions 3.0.6–3.3.26 of com.PhonePe.app. The issue is an information disclosure risk where an attacker could uncover credit/debit card number, expiry date, and CVV. The exploitation condition described across sources requires the user to install a ...

CVE-2018-17403

PhonePe wallet (com.PhonePe.app) on Android, versions 3.0.6–3.3.26, is vulnerable to user impersonation and unauthorized account setup via a malicious app that users must explicitly install and grant Accessibility permission to. This capability relies on the Android Accessibility framework and is...

CVE-2018-17401

PhonePe wallet (com.PhonePe.app) versions 3.0.6–3.3.26 are reported vulnerable to an Account Takeover via the Forgot Password flow. Exploitation requires the user to install a malicious app and grant accessibility permission, leveraging Android warnings to bypass user oversight. Impact is describ...

PT-2018-14015 · Phonepe · Phonepe

Name of the Vulnerable Software and Affected Versions: PhonePe wallet aka com.PhonePe.app versions 3.0.6 through 3.3.26 Description: The issue might allow attackers to discover sensitive information, including Credit/Debit card numbers, expiration dates, and CVV numbers. To exploit this, a user...

PT-2018-14014 · Phonepe · Phonepe

Name of the Vulnerable Software and Affected Versions: PhonePe wallet aka com.PhonePe.app versions 3.0.6 through 3.3.26 Description: The issue allows attackers to perform Account Takeover attacks by exploiting the Forgot Password feature. To exploit this, the user has to explicitly install a...

PT-2018-14016 · Phonepe · Phonepe

Name of the Vulnerable Software and Affected Versions: PhonePe wallet aka com.PhonePe.app versions 3.0.6 through 3.3.26 Description: The issue might allow attackers to impersonate a user and set up their account without their knowledge. To exploit this, the user has to explicitly install a...

PhonePe - India's Payment App - Base64 encoded String, Customized SSL, Dangerous filesystem permissions vulnerabilities

HackApp vulnerability scanner discovered that application PhonePe - India's Payment App published at the 'play' market has multiple vulnerabilities...